make:user complains missing symfony/security package, but package is abandoned

[fabpico]

I want to use php bin/console make:user as in https://symfony.com/doc/current/security.html#the-user.

My composer.json:

{
  "require": {
    "symfony/runtime": "^6.2",
    "symfony/http-kernel": "^6.2",
    "symfony/framework-bundle": "^6.2",
    "symfony/console": "^6.2"
  },
  "require-dev": {
    "phpunit/phpunit": "^9.5",
    "symfony/maker-bundle": "^1.48"
  },
  "autoload": {
    "psr-4": {
      "App\\": "src/"
    }
  },
  "config": {
    "allow-plugins": {
      "symfony/runtime": true
    }
  }
}

When I make

php bin/console make:user

I recieve

[ERROR] Missing package: to use the make:user command, run:                                                            

         composer require security

When I do

composer require security

I receive

Could not find package security.  

  Did you mean one of these?        
      symfony/security              
      symfony/security-acl          
      symfony/security-core         
      symfony/security-http         
      symfony/security-csrf

When I do

composer require symfony/security

I receive

- Installing symfony/security (2.0.6): Extracting archive
2 package suggestions were added by new dependencies, use `composer suggest` to see details.
Package symfony/security is abandoned, you should avoid using it. No replacement was suggested.
Generating autoload files
56 packages you are using are looking for funding.
Use the `composer fund` command to find out more!
Found 4 security vulnerability advisories affecting 1 package.

And I can still not run php bin/console make:user.

When I do

composer suggest 

I receive

phpunit/phpunit suggests:
 - ext-soap: *

symfony/console suggests:
 - symfony/lock
 - symfony/process

symfony/framework-bundle suggests:
 - ext-apcu: For best performance of the system caches
 - symfony/form: For using forms
 - symfony/property-info: For using the property_info service
 - symfony/serializer: For using the serializer service
 - symfony/validator: For using validation
 - symfony/web-link: For using web links, features such as preloading, prefetching or prerendering

symfony/http-kernel suggests:
 - symfony/browser-kit

symfony/security suggests:
 - symfony/class-loader: >=2.0
 - symfony/form: >=2.0

9 additional suggestions by transitive dependencies can be shown with --all

Now what should I install for being able to use php bin/console make:user?

• Tried also to install symfony/security-core, still complaining
• Tried also to install doctrine/orm, still complaining

[wouterj]

The security is a flex alias. If you have the Flex Composer plugin installed, it will install symfony/security-bundle (see https://github.com/symfony/recipes/blob/flex/main/RECIPES.md for a list of Flex aliases).

@weaverryan shouldn't MakerBundle use full package names, like we do in the docs?

[fabpico]

@wouterj Yeah just found out, assumed a relation to doctrine and looked into https://github.com/doctrine/DoctrineBundle/blob/2.8.x/composer.json, there is a symfony/security-bundle dependency. After installing symfony/security-bundle directly, the command is able to run.

I don't use Flex. Can the maker bundle maybe just be defined with the symfony/security-bundle dependency?

[weaverryan]

Yes, we had another PR recently for another part of maker bundle to switch from the alias to the full package name. The user is probably copying the composer require command, so there's not a huge benefit to showing the alias (and it confuses some people).

PR welcome to change to the full package name!